US7124294B2 - Electronic certificate system - Google Patents

Electronic certificate system Download PDF

Info

Publication number
US7124294B2
US7124294B2 US10/059,332 US5933202A US7124294B2 US 7124294 B2 US7124294 B2 US 7124294B2 US 5933202 A US5933202 A US 5933202A US 7124294 B2 US7124294 B2 US 7124294B2
Authority
US
United States
Prior art keywords
validity
information
user apparatus
electronic certificate
validity check
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related, expires
Application number
US10/059,332
Other languages
English (en)
Other versions
US20030093676A1 (en
Inventor
Shunji Kawamura
Taminori Tomita
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hitachi Ltd
Original Assignee
Hitachi Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hitachi Ltd filed Critical Hitachi Ltd
Assigned to HITACHI, LTD. reassignment HITACHI, LTD. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: TOMITA, TAMINORI, KAWAMURA, SHUNJI
Publication of US20030093676A1 publication Critical patent/US20030093676A1/en
Application granted granted Critical
Publication of US7124294B2 publication Critical patent/US7124294B2/en
Adjusted expiration legal-status Critical
Expired - Fee Related legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements

Definitions

  • the present invention relates to a system which uses a network for providing services.
  • the present invention also includes apparatuses and program products constituting the system.
  • the present invention relates in particular to a certificate validity checking method and apparatus, especially for use in a system using certificates based on a public key.
  • a method of providing services in a system using a network is disclosed in Japanese Published Unexamined Patent Application No. 2000-123095. In this publication, a technique is disclosed which defines many different types of electronic tickets for general purpose use to provide services.
  • a recent major trend in electronic commerce and communications is toward authentication processing using public-key-based certificates (hereinafter referred to as public key certificates or simply as certificates), and communication encryption processing.
  • an electronic certificate there are provided an issuance date, an expiration date, the signature of an issuer, and the like, in addition to information co concerning the certifyee of the certificate. During the effective period, there should be no problem in the validity of the certificate itself.
  • certificate nullification processing An authentication station periodically (e.g., twice per day) prepares and stores a nullification list containing a list of serial numbers of certificates that became null during the effective period.
  • the nullification list is called a CRL (Certificate Revocation List) according to RFC (Request for Comments) 2459 of the IETF (Internet Engineering Task Force).
  • certificate validity checking method a method has been employed by which users obtain a CRL by some method (periodic distribution by an authentication station to users or access to the authentication station by users), and confirm the validity of the certificate by confirming that there is no certificate information to be checked for validity in the CRL.
  • the CRL data In applications using a CRL distributed from an authentication station, the CRL data must be analyzed to determine whether a certificate is nullified.
  • OCSP Online Certificates Status Protocol
  • RFC 2560 of IETF lessens loads on the applications and defines a protocol for inquiring of an OCSP responder as to whether a certificate itself is valid.
  • the responder obtains and manages a nullification list issued from an authentication station, whereby the applications can manipulate a validity checking protocol called OCSP to check for the validity without the applications themselves searching the nullification list.
  • OCSP validity checking protocol
  • the present invention has the following configuration.
  • a service requesting apparatus used by a user requesting services, a service receiving apparatus used by a user receiving services, and a service providing apparatus performing information processing for providing services are connected with each other over a network, wherein the service providing apparatus receives a service request sent from the service receiving apparatus and determines whether to perform information processing for providing the service, based on a condition related to the service request, for performing information processing for the service receiving apparatus, the information processing being ascribable to processing of the service requesting apparatus.
  • the above-described condition also includes the existence of permission information that allows provision or receipt of a service sent from the service requesting apparatus to the service receiving apparatus.
  • the permission information may be created by either the service providing apparatus or the service requesting apparatus. Also, it may be created by a third apparatus.
  • the above-described condition includes the inclusion of the service receiving apparatus in an information processing apparatus registered in advance.
  • information about the information processing apparatus is registered in the service providing apparatus. It may also be registered in an apparatus accessible from the service providing apparatus.
  • the service providing apparatus When a service request is received, the service providing apparatus sends out inquiry information about whether to provide the service to the service requesting apparatus.
  • the above-described condition includes a reply to the inquiry.
  • information for identifying the service receiving apparatus is sent from the service providing apparatus to the service requesting apparatus.
  • the above-described condition includes information indicating limitations on a service to be provided.
  • the limitations include at least one of a number of service provisions and a provision date.
  • Services include checking for validity of an electronic certificate.
  • the service requesting apparatus is an information processing apparatus managed by an issuee of the certificate.
  • the service receiving apparatus is an information processing apparatus that receives the certificate from the service requesting apparatus.
  • the service providing apparatus is a certificate validity checking server.
  • the service providing apparatus may include an information processing apparatus that issues the certificate.
  • Other services include distribution of information including programs, music, and images, and delivery of products including presents.
  • FIG. 1 is a block diagram of a system according to a first embodiment of the present invention.
  • FIG. 2 is a diagram showing the data structure of a validity check permit in the first embodiment.
  • FIG. 3 is a diagram showing the data structure of an issued validity check permit table in the first embodiment.
  • FIG. 4 is a diagram showing the data structure of a validity permit inspection table in the first embodiment.
  • FIG. 5 is a flowchart showing a certificate issuing procedure in a processing procedure in the first embodiment.
  • FIG. 6 is a flowchart showing a procedure for issuing a validity check permit in the processing procedure in the first embodiment.
  • FIG. 7 is a flowchart showing a procedure for checking for validity of a certificate in the processing procedure in the first embodiment.
  • FIG. 8 is a detailed flowchart of validity check permit inspection processing in the processing in FIG. 7 .
  • FIG. 9 is a block diagram showing the configuration of a permission registration server according to a second embodiment.
  • FIG. 10 is a diagram showing the data structure of a validity check permission registration table in the second embodiment.
  • FIG. 11 is a flowchart showing a permission registration procedure of validity confirmation in a processing procedure in the second embodiment.
  • FIG. 12 is a flowchart showing a procedure for checking for validity of a certificate in the processing procedure in the second embodiment.
  • FIG. 13 is a detailed flowchart of registration content check processing of validity check permission registration in the processing in FIG. 12 .
  • FIG. 14 is a flowchart showing a processing procedure according to a third embodiment of the present invention.
  • FIG. 15 is a diagram showing the data structure of an accounting information table according to an embodiment of the present invention.
  • FIG. 1 is a block diagram showing the configuration of a certificate validity checking system when the present invention is applied to a validity check service for a public key certificate.
  • a server issuing a certificate of the key will be referred to as a certificate issuing server.
  • a certificate validity checking server For an inquiry about certificate validity from a terminal, a server that checks whether a certificate specified by the terminal is valid and that returns the result of the processing will be referred to as a certificate validity checking server. Information giving permission for a request to execute certificate validity check processing to the certificate validity checking server will be referred to as a validity check permit.
  • a server that creates a validity check permit and sends it to the terminal will be referred to as a permit issuing server.
  • a server that issues a validity check permit and holds information (accounting information) about charges imposed on users according to validity check processing will be referred to as a settlement server.
  • the system comprises a certificate issuing server 110 , a permit issuing server 120 , a certificate validity checking server 130 , a settlement server 190 , and terminals 140 , 150 and 160 respectively used by user A, user B, and user C, who use a certificate validity check service.
  • the certificate issuing server 110 , the permit issuing server 120 , the certificate validity checking server 130 , the settlement server 190 , and the terminals 9 are respectively controlled by control units 112 , 122 , 132 , 192 , 142 , and 152 , and they respectively have network connection parts 111 , 121 , 131 , 191 , 141 , and 151 for mutual data sending and receiving among them through connection with a network 170 , such as the Internet, via a communication line.
  • a network 170 such as the Internet
  • the present invention is not limited to three.
  • the servers are respectively shown as only one each, there may exist plural servers having an identical function.
  • the servers are separately shown, they may be embodied in a physically identical server.
  • the certificate issuing server 110 has a program having a certificate creating function 115 , a certificate sending function 116 and a signature function 117 within a storage unit 113 .
  • the permit issuing server 120 has a program 124 , having a validity check permit creating function 125 , a validity check permit sending function 126 , and a signature and signature verification function 127 , as well as an issued validity check permit table 300 within a storage unit 123 .
  • the certificate validity checking server 130 has a program, having a validity check permit receiving function 135 , a validity check permit inspection function 136 , a certificate validity checking function 137 , and a signature and signature verification function 138 , as well as a validity check permit inspection table 400 within a storage unit 133 .
  • the settlement server 190 has a program 194 , having an accounting information receiving function 195 , and an accounting information table 1500 within a storage unit 193 .
  • the terminals 140 and 150 respectively have programs 144 and 154 respectively having certificate sending/receiving functions 145 and 155 , validity check permit sending/receiving functions 146 and 156 , and signature and signature verification functions 147 and 157 within storage units 143 and 153 .
  • FIG. 2 is a diagram showing the data structure of a validity check permit.
  • the validity check permit 200 includes: identification information 201 of a permit issuing server; identification information 202 of a validity check permit; identification information 203 of a certificate issuing server; certificate identification information 204 ; identification information 205 of a certificate validity checking server; an expiration date of validity check permit 206 ; an upper limit 207 on the number of uses of a validity check permit; and an electronic signature 208 of a permit issuing server as information for verifying whether the validity check permit has been tampered with after being created.
  • the certificate validity checking server checks for the validity of a public key certificate identified by the identification information 203 of the certificate issuing server and the certificate identification information 204 included in the validity check permit.
  • FIG. 3 is a diagram showing the data structure of the issued validity check permit table 300 .
  • the issued validity check permit table 300 consists of: identification information 301 of a validity check permit; identification information 302 of a certificate issuing server; certificate identification information 303 ; identification information 304 of certificate validity checking server; an expiration date 305 of validity check permit; and an upper limit 306 on the number of uses of validity check permit.
  • FIG. 4 is a diagram showing the data structure of the validity check permit inspection table 400 .
  • the validity check permit inspection table 400 consists of: identification information 401 of a permit issuing server; identification information 402 of a validity check permit; an upper limit 403 on the number of uses of a validity check permit; and an accumulated number 404 of uses of a validity check permit.
  • FIG. 15 is a diagram showing the data structure of the accounting information table 1500 .
  • FIGS. 5 , 6 , and 7 are flowcharts showing a processing procedure of this embodiment. The operation of each part will be described based on the flowcharts.
  • the certificate issuing server 110 for a certificate issuance request from a user A, creates the certificate using the certificate creating function 115 (step 501 ) and affixes an electronic signature of the certificate issuing server to the certificate as information for detecting a tampering with the certificate.
  • the certificate issuing server 110 sends the certificate to terminal 140 of the user A using the certificate sending function 116 via a network (step 502 ).
  • the terminal 140 using the certificate receiving function 145 , receives and stores the certificate sent from the certificate issuing server 110 (step 503 ).
  • the terminal 140 sends a request to issue a validity check permit to the permit issuing server 120 (step 601 ).
  • the issuance request includes identification information of the permit issuing server, identification information of the certificate of the user A, an upper limit on the number of uses of a validity check permit, and an expiration date of the validity check permit, and is provided with an electronic signature of the user A.
  • the permit issuing server 120 receives the issuance request (step 602 ), verifies the electronic signature using the signature and signature verification function 127 , and confirms that the issuance request has been created by the user A and has not been tampered with (step 603 ).
  • a method of verifying an electronic signature can be performed using the public key cryptosystem.
  • the permit issuing server 120 sends information indicating that the issuance request is invalid to the terminal 140 (step 608 ), and the terminal 140 receives the result (step 609 ).
  • the permit issuing server 120 creates a validity check permit 200 using the validity check permit creating function 125 and affixes an electronic signature of the permit issuing server to the validity check permit, as information for detecting tampering (step 604 ).
  • Identification information of the certificate issuing server and the certificate identification information 204 included in the validity check permit 200 are information included in the issuance request and identify the server 110 that issued the certificate of the user A and the certificate of the user A, respectively.
  • the permit issuing server 120 adds the data of the created validity check permit 200 to the issued validity check permit table 300 (step 605 ).
  • the permit issuing server 120 sends the validity check permit 200 to the terminal 140 of the user A using the validity check permit sending/receiving function 126 via the network (step 606 ).
  • the permit issuing server 120 sends accounting information (payer's identification information, receiver's identification information, charged amounts, and occurrence reason) to the settlement server 190 (step 610 ).
  • the terminal 140 using the validity check permit sending/receiving function 146 , receives the validity check permit sent from the permit issuing server 120 (step 607 ).
  • the settlement server 190 uses the accounting information receiving function 195 , receives the accounting information sent from the permit issuing server 120 and adds the received accounting information to the accounting information table 1500 after adding an occurrence date (step 611 ).
  • the terminal 140 sends the validity check permit 200 using the validity check permit sending/receiving functions 146 via the network (step 701 ).
  • the terminal 150 uses the validity check permit sending/receiving function 156 , receives the validity check permit 200 sent from the terminal 140 (step 702 ).
  • the terminal 150 fetches identification information 205 of certificate validity checking server from the validity check permit 200 (step 703 ), and it sends a certificate validity check request and the validity check permit 200 , using the validity check permit sending/receiving function 156 , to a validity checking server 130 by the fetched identification information (step 704 ).
  • the certificate validity checking server 130 uses the validity check permit receiving function 135 , receives the validity check permit 200 sent from the terminal 150 (step 705 ).
  • the certificate validity checking server 130 uses the validity check permit inspection function 136 , checks whether the received validity check permit 200 is valid (step 706 ). After inspection of all items or after a proper type of inspection is conducted, if it is determined that all items are correct, the certificate validity checking server 130 , for the certificate validity check request, checks for the validity of the certificate. However, if it is determined by the inspection that the validity check permit 200 is incorrect and invalid, the certificate validity checking server 130 does not check for the validity of the certificate and to the terminal 150 a result indicating that the certificate validity checking processing cannot be performed (step 710 ), and the terminal 150 receives this result (step 711 ).
  • the certificate validity checking server 130 sends accounting information (payer's identification information, receiver's identification information, charged amounts, and occurrence reason) to the settlement server 190 (step 712 ).
  • the settlement server 190 using the accounting information receiving function 195 , receives the accounting information sent from the certificate validity checking server 130 and adds the received accounting information to the accounting information table 1500 after adding an occurrence date (step 713 ).
  • FIG. 8 is a flowchart showing in detail the processing (step 706 ) that checks for validity of a validity check permit. The operation of each part will be described based on the flowchart.
  • an electronic signature of the validity check permit 200 is verified (step 801 ), and it is determined whether the validity check permit 200 is created by the permit issuing server 120 and has not been tampered with after being created (step 802 ). If it has not been tampered with, the certificate validity checking server 130 reads an expiration date of validity check permit 206 included in the validity check permit 200 to check whether the expiration date has passed (step 803 ). If the expiration date has not passed, the certificate validity checking server 130 fetches identification information 201 of the permit issuing server and identification information 202 of the validity check permit from the validity check permit 200 (step 804 ), and searches the validity check permit inspection table 400 for the fetched identification information (step 805 ).
  • An upper limit 403 on the number of uses and an accumulated number of uses 404 of the validity check permit are obtained from the validity check permit inspection table 400 (step 807 ). If the accumulated number of uses 404 is smaller than the upper limit 403 on the number of uses, the certificate validity checking server 130 adds “1” to the accumulated number of uses 404 of the validity check permit inspection table 400 (step 809 ).
  • the certificate validity checking server 130 fetches identification information 203 of the certificate issuing server and certificate identification information 204 from the validity check permit 200 (step 707 ) and checks for the validity of a certificate identified by the fetched identification information (step 708 ).
  • Certificate validity checking processing can be achieved using the public key cryptosystem. For example, one method is to obtain and refer to a CRL issued by a certificate issuing server to check whether the CRL is provided with a certificate indicating validity.
  • the certificate validity checking server 130 sends the result of validity checking processing to the terminal 150 after affixing an electronic signature to it (step 709 ), and the terminal 150 receives the result (step 711 ).
  • a validity check permit is limited by the combination of an expiration date and an upper limit on the number of uses of a validity check permit
  • limitation methods are not limited to this.
  • the use of a validity check permit may be limited simply by an expiration date or merely by an upper limit on the number of uses, or it may be permitted only for a given period after the first use of the validity check permit.
  • the validity check permit 200 holds certificate identification information 204 and use limitation information (expiration date 206 and an upper limit 207 on the number of uses) of the validity check permit, these items of information may be managed in the permit issuing server 120 .
  • the validity check permit 200 holds identification information 201 of the permit issuing server and identification information 202 of the validity check permit, and a certificate validity checking server 130 receiving the validity check permit 200 inquires of a permit issuing server identified by the identification information of the permit issuing server about certificate identification information and use limitation information of the validity check permit.
  • the validity check permit 200 is created by the permit issuing server 120
  • the user A may create it.
  • identification information 201 of permit issuing server of the validity check permit 200 is not required, and an electronic signature of the user A is affixed instead of an electronic signature 208 of the permit issuing server.
  • the terminal 150 of the user B sends the validity check permit 200 to a certificate validity checking server 130 identified by identification information 205 of the certificate validity checking server included in the validity check permit 200 to request that a check be made to see if the certificate is valid
  • the validity check permit 200 may be sent to other equipment so that the equipment receiving it, in place of the terminal 150 will send the validity check permit 200 to the certificate validity checking server 130 to request that a check is made to see if the certificate is valid and return the check result to the terminal 150 .
  • accounting information is sent to the settlement server in both of the processing steps (steps 610 and 712 ) of permit issuance and certificate validity checking, accounting information may be sent in only one of these processing steps.
  • a second embodiment will be described based on the configuration of the first embodiment.
  • a permission registration server 180 shown in FIG. 9 has a network connection part 181 which is connected to the network 170 .
  • the permission registration server 180 is an apparatus that allow users to have the certificate validity checking server 130 perform certificate validity checking processing. It is controlled by a control unit 182 and has a program 184 , having a signature verification function 185 , and a validity check permission registration table 1000 within a storage unit 183 .
  • FIG. 10 is a diagram showing the data structure of the validity check permission registration table 1000 .
  • the validity check permission registration table 1000 consists of identification information 1001 of a permittee, identification information 1002 of a certificate issuing server, certificate identification information 1003 , registration expiration date 1004 , an upper limit 1005 on the number of uses, and an accumulated number 1006 of uses.
  • each of the servers there may exist plural servers having an identical function. Although the servers are respectively different, they may be an identical server.
  • FIGS. 11 and 12 are flowcharts showing a processing procedure used in this embodiment. The operation of each part will be described based on the flowcharts.
  • the step of issuing a certificate (step 501 ) to the step of the terminal 140 storing the certificate (step 503 ) are the same as those in the first embodiment.
  • the terminal 140 sends a registration request to the permission registration server 180 (step 1101 ).
  • the registration request includes identification information of a certificate issuing server that issued a certificate of user A, identification information of the certificate of user A, identification information of user B subject to permission registration, and permission limitation information, such as a deadline for permission of the validity check request and an upper limit on the number of validity check requests, and the registration request is provided with an electronic signature of user A.
  • the permission registration server 180 receives the registration request (step 1102 ) and checks whether the registration request is valid (step 1103 ).
  • the check consists of a check about whether the electronic signature of user A is correct and a check about whether information contained in the registration request conforms to a predetermined format.
  • the permission registration server 180 sends this fact to the terminal 140 (step 1106 ), which receives the result (step 1107 ).
  • the permission registration server 180 adds the identification information of the certificate issuing server, certificate identification information, identification information of the permittee (user B), the registration expiration date, an upper limit on the number of permitted uses, and an accumulated number of uses of “0” to the validity check permission registration table 1000 (step 1104 ), and sends a registration completion event to the terminal 140 (step 1105 ), which receives the result (step 1107 ).
  • the permission registration server 180 sends accounting information (payer's identification information, receiver's identification information, charged amounts, and occurrence reason) to the settlement server 190 (step 1108 ).
  • the settlement server 190 uses the accounting information receiving function 195 , receives the accounting information sent from the permission registration server 180 and adds the received accounting information to the accounting information table 1500 after adding an occurrence date (step 1109 ).
  • the terminal 150 of the user B who intends to check for validity of the certificate of the user A, sends a validity check request to the certificate validity checking server 130 (step 1201 ).
  • the validity check request includes identification information of user B, identification information of a certificate issuing server that issued the certificate of the user A, identification information of the certificate of the user A, and identification information of a permission registration server in which the user B is permitted to check for validity, and is provided with an electronic signature of the user B.
  • the certificate validity checking server 130 receives the validity check request (step 1202 ) and verifies the electronic signature to authenticate the user B (step 1203 ).
  • the certificate validity checking server 130 informs the terminal 150 that validity checking processing cannot be performed (step 1204 ), and the terminal 150 receives this result (step 1214 ).
  • the certificate validity checking server 130 reads identification information of permission registration server from the validity check request (step 1205 ), and, in order to determine whether the user B is permitted to check for validity of the certificate of the user A, it sends a permission registration check request to the permission registration server 180 (step 1206 ).
  • the permission registration check request includes identification information of the user B, identification information of a server that issued the certificate of the user A, and identification information of the certificate of the user A.
  • the permission registration server receives the permission registration check request (step 1207 ), searches the validity check permission registration table for the request, checks the registration contents (step 1208 ), and sends a check result to the certificate validity checking server 130 (step 1209 ).
  • FIG. 13 is a flowchart showing details of the permission registration content checking processing (step 1208 ). The processing procedure of step 1208 will be described based on the flowchart.
  • identification information of a server that issued the certificate of the user A, identification information of the certificate of the user A, and identification information of the user B are respectively used to search the items of identification information 1002 of the certificate issuing server, certificate identification information 1003 , and identification information 1001 of the permittee of the validity check permission registration table 1000 (step 1301 ).
  • the result of checking is “no permission” (step 1308 ).
  • step 1304 it is checked whether the registration expiration date 1004 has passed. If the registration expiration date 1004 has passed, the result of registration content checking is “no permission” (step 1308 ).
  • the registration expiration date 1004 it is checked whether the accumulated number 1006 of uses is smaller than the upper limit 1005 on the number of uses (step 1305 ). If the accumulated number 1006 of uses is equal to or greater than the upper limit 1005 on the number of uses, the result of registration content checking is “no permission” (step 1308 ). If it is smaller than the upper limit 1005 on the number of uses, “1” is added to the accumulated number of uses of the validity check permission registration table 1000 (step 1306 ), and the result of registration content checking is “permission” (step 1307 ).
  • the certificate validity checking server 130 receives the check result for the permission registration check request from the permission registration server 180 (step 1210 ).
  • the check result is read (step 1211 ). If the check result is “no permission”, the certificate validity checking server 130 informs the terminal 150 that validity check processing cannot be performed (step 1204 ), and the terminal 150 receives this result (step 1214 ).
  • the certificate validity checking server 130 checks whether a certificate, identified by identification information 203 of the certificate issuing server and certificate identification information 204 included in the validity check request, is valid (step 1212 ), and sends the result of the validity check processing to the terminal 150 after affixing an electronic signature to the result (step 1213 ), and the terminal 150 receives the result (step 1215 ).
  • the certificate validity checking server 130 sends accounting information (payer's identification information, receiver's identification information, charged amounts, and occurrence reason) to the settlement server 190 (step 1215 ).
  • the settlement server 190 using the accounting information receiving function 195 , receives the accounting information sent from the certificate validity checking server 130 , and adds the received accounting information to the accounting information table 1500 after adding an occurrence date (step 1216 ).
  • a validity check permit is limited by combination of an expiration date and an upper limit on the number of uses of a validity check permit, limitation methods are not limited to this.
  • accounting information is sent to the settlement server in both of the processing steps (steps 610 and 712 ) of permission registration and certificate validity checking, accounting information may be sent in only one of the processing steps.
  • a third embodiment will be described based on the configuration of the first embodiment.
  • FIG. 14 is a flowchart showing the processing procedure used in this embodiment. The operation of each part will be described based on the flowcharts.
  • the step of issuing a certificate (step 501 ) to the step of the terminal 140 storing the certificate (step 503 ) are the same as those in the first embodiment.
  • the terminal 150 of the user B who intends to check for validity of the certificate of the user A, sends a validity check request to the certificate validity checking server 130 (step 1401 ).
  • the validity check request includes identification information of a certificate issuing server that issued the certificate of the user A, and identification information of the certificate of the user A, and the validity check request is provided with an electronic signature of the user B.
  • the certificate validity checking server 130 receives the validity check request (step 1402 ) and verifies the electronic signature to authenticate the user B (step 1403 ).
  • the certificate validity checking server 130 informs the terminal 150 that validity checking processing cannot be performed (step 1404 ), and the terminal 150 receives this result (step 1212 ).
  • the certificate validity checking server 130 sends a permission request to the terminal 140 of the user A (step 1405 ).
  • the permission request includes identification information of the user B.
  • the terminal 140 receives the permission request (step 1406 ), and sends, to the certificate validity checking server 130 , the result of “permission” or “no permission” to indicate whether the user B identified by identification information included in the permission request is permitted to check for validity of the certificate (step 1407 ).
  • the certificate validity checking server 130 receives the result from the terminal 140 (step 1408 ) and checks the result (step 1409 ).
  • the certificate validity checking server 130 informs the terminal 150 that validity check processing cannot be performed, as a result of the certificate validity check request (step 1404 ), and the terminal 150 receives the result (step 1212 ).
  • the certificate validity checking server 130 checks whether a certificate identified by identification information of a certificate issuing server and certificate identification information included in the validity check request is valid (step 1410 ), and sends a validity check result to the terminal 150 (step 1411 ), and the terminal 150 receives the certificate validity check result.
  • the certificate validity checking server 130 sends accounting information (payer's identification information, receiver's identification information, charged amounts, and occurrence reason) to the settlement server 190 (step 1413 ).
  • the settlement server 190 using the accounting information receiving function 195 , receives the accounting information sent from the certificate validity checking server 130 , and adds the received accounting information to the accounting information table 1500 after adding an occurrence date (step 1414 ).
  • the validity check processing may be performed also for requests from users who are not assumed to check for validity of a certificate, or requests in an unexpected situation.
  • the present invention by limiting execution of certificate validity check processing according to the will of the certifyees of certificates, validity check processing unnecessary for the certifyees of certificates can be prevented, and the certifyees of certificates can be charged according to the number of executions of certificate validity check processing.
  • the present invention can be applied to limit a user's browsing by other users. Also, the present invention can be applied to service providing method that transfers the right to use server-provided online services from one user (service provider) to other users (service recipients) with limitations imposed by the service provider.
  • the present invention makes it possible for a service providing apparatus to appropriately perform information processing for service provision.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
US10/059,332 2001-11-13 2002-01-31 Electronic certificate system Expired - Fee Related US7124294B2 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2001346848A JP2003150735A (ja) 2001-11-13 2001-11-13 電子証明書システム
JP2001-346848 2001-11-13

Publications (2)

Publication Number Publication Date
US20030093676A1 US20030093676A1 (en) 2003-05-15
US7124294B2 true US7124294B2 (en) 2006-10-17

Family

ID=19159941

Family Applications (1)

Application Number Title Priority Date Filing Date
US10/059,332 Expired - Fee Related US7124294B2 (en) 2001-11-13 2002-01-31 Electronic certificate system

Country Status (2)

Country Link
US (1) US7124294B2 (ja)
JP (1) JP2003150735A (ja)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040111607A1 (en) * 2002-12-06 2004-06-10 International Business Machines Corporation Method and system for configuring highly available online certificate status protocol responders
US20050193204A1 (en) * 2004-01-09 2005-09-01 David Engberg Communication-efficient real time credentials for OCSP and distributed OCSP
US20050255829A1 (en) * 2004-04-30 2005-11-17 Kirkup Michael G System and method for checking digital certificates
US7853791B1 (en) * 2006-05-16 2010-12-14 Sprint Communications Company L.P. System and method for certificate based redirection
US20130346743A1 (en) * 2012-06-25 2013-12-26 International Business Machines Corporation Digital certificate issuer-correlated digital signature verification

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8388440B2 (en) * 2003-10-20 2013-03-05 Sony Computer Entertainment America Llc Network account linking
US20050144144A1 (en) * 2003-12-30 2005-06-30 Nokia, Inc. System and method for authenticating a terminal based upon at least one characteristic of the terminal located at a position within an organization
US20050149724A1 (en) * 2003-12-30 2005-07-07 Nokia Inc. System and method for authenticating a terminal based upon a position of the terminal within an organization
US7457874B2 (en) * 2004-02-20 2008-11-25 Microsoft Corporation Architecture for controlling access to a service by concurrent clients
US7549048B2 (en) * 2004-03-19 2009-06-16 Microsoft Corporation Efficient and secure authentication of computing systems
US20050229004A1 (en) * 2004-03-31 2005-10-13 Callaghan David M Digital rights management system and method
JP2005352523A (ja) * 2004-05-10 2005-12-22 Sony Corp 情報処理装置、および情報処理方法、並びにコンピュータ・プログラム
US7600123B2 (en) * 2005-12-22 2009-10-06 Microsoft Corporation Certificate registration after issuance for secure communication
US7958368B2 (en) * 2006-07-14 2011-06-07 Microsoft Corporation Password-authenticated groups
US8307411B2 (en) * 2007-02-09 2012-11-06 Microsoft Corporation Generic framework for EAP
US8356172B2 (en) * 2009-10-08 2013-01-15 At&T Intellectual Property I, L.P. Apparatus and method for monitoring certificate acquisition
US11303458B2 (en) 2018-04-09 2022-04-12 Blackberry Limited Method and system for reduced V2X receiver processing load using network based application layer message processing
JP2019070802A (ja) * 2018-10-09 2019-05-09 株式会社ニコン・エシロール 管理システム

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5712914A (en) * 1995-09-29 1998-01-27 Intel Corporation Digital certificates containing multimedia data extensions
JPH11149504A (ja) 1997-11-17 1999-06-02 Hitachi Ltd 個人情報管理方法および装置
JP2000123095A (ja) 1998-08-12 2000-04-28 Nippon Telegr & Teleph Corp <Ntt> 電子チケット記録媒体、処理方法及び処理装置
JP2001005833A (ja) 1999-06-24 2001-01-12 Sony Corp 情報処理装置および情報処理方法、並びに記録媒体
US20020013772A1 (en) * 1999-03-27 2002-01-31 Microsoft Corporation Binding a digital license to a portable device or the like in a digital rights management (DRM) system and checking out / checking in the digital license to / from the portable device or the like
US20020035686A1 (en) * 2000-07-14 2002-03-21 Neal Creighton Systems and methods for secured electronic transactions
US20020053023A1 (en) * 2000-08-17 2002-05-02 Patterson Andrew John Certification validation system
US6754665B1 (en) 1999-06-24 2004-06-22 Sony Corporation Information processing apparatus, information processing method, and storage medium

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5712914A (en) * 1995-09-29 1998-01-27 Intel Corporation Digital certificates containing multimedia data extensions
JPH11149504A (ja) 1997-11-17 1999-06-02 Hitachi Ltd 個人情報管理方法および装置
US6564323B2 (en) 1997-11-17 2003-05-13 Hitachi, Ltd. Personal information controlling method and personal information controlling apparatus
JP2000123095A (ja) 1998-08-12 2000-04-28 Nippon Telegr & Teleph Corp <Ntt> 電子チケット記録媒体、処理方法及び処理装置
US20020013772A1 (en) * 1999-03-27 2002-01-31 Microsoft Corporation Binding a digital license to a portable device or the like in a digital rights management (DRM) system and checking out / checking in the digital license to / from the portable device or the like
JP2001005833A (ja) 1999-06-24 2001-01-12 Sony Corp 情報処理装置および情報処理方法、並びに記録媒体
US6754665B1 (en) 1999-06-24 2004-06-22 Sony Corporation Information processing apparatus, information processing method, and storage medium
US20020035686A1 (en) * 2000-07-14 2002-03-21 Neal Creighton Systems and methods for secured electronic transactions
US20020053023A1 (en) * 2000-08-17 2002-05-02 Patterson Andrew John Certification validation system

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040111607A1 (en) * 2002-12-06 2004-06-10 International Business Machines Corporation Method and system for configuring highly available online certificate status protocol responders
US7318155B2 (en) * 2002-12-06 2008-01-08 International Business Machines Corporation Method and system for configuring highly available online certificate status protocol responders
US20050193204A1 (en) * 2004-01-09 2005-09-01 David Engberg Communication-efficient real time credentials for OCSP and distributed OCSP
US7966487B2 (en) * 2004-01-09 2011-06-21 Corestreet, Ltd. Communication-efficient real time credentials for OCSP and distributed OCSP
US20050255829A1 (en) * 2004-04-30 2005-11-17 Kirkup Michael G System and method for checking digital certificates
US7853791B1 (en) * 2006-05-16 2010-12-14 Sprint Communications Company L.P. System and method for certificate based redirection
US20130346743A1 (en) * 2012-06-25 2013-12-26 International Business Machines Corporation Digital certificate issuer-correlated digital signature verification
US20130346744A1 (en) * 2012-06-25 2013-12-26 International Business Machines Corporation Digital certificate issuer-correlated digital signature verification
US8959337B2 (en) * 2012-06-25 2015-02-17 International Business Machines Corporation Digital certificate issuer-correlated digital signature verification
US9197631B2 (en) * 2012-06-25 2015-11-24 International Business Machines Corporation Digital certificate issuer-correlated digital signature verification
US9426146B2 (en) 2012-06-25 2016-08-23 International Business Machines Corporation Digital certificate issuer-correlated digital signature verification
US9749139B2 (en) 2012-06-25 2017-08-29 International Business Machines Corporation Digital certificate issuer-correlated digital signature verification
US9755838B2 (en) 2012-06-25 2017-09-05 International Business Machines Corporation Digital certificate issuer-correlated digital signature verification

Also Published As

Publication number Publication date
JP2003150735A (ja) 2003-05-23
US20030093676A1 (en) 2003-05-15

Similar Documents

Publication Publication Date Title
US7124294B2 (en) Electronic certificate system
US6047268A (en) Method and apparatus for billing for transactions conducted over the internet
Cox et al. NetBill Security and Transaction Protocol.
US6105131A (en) Secure server and method of operation for a distributed information system
US20170270520A1 (en) Centralized electronic commerce card transactions
US7039611B2 (en) Managing attempts to initiate authentication of electronic commerce card transactions
CN102483779B (zh) 从id-令牌中读取属性的方法及其计算机系统
RU2292589C2 (ru) Аутентифицированный платеж
US8060922B2 (en) Consumer internet authentication device
RU2308755C2 (ru) Система и способ предоставления доступа к защищенным услугам с однократным вводом пароля
US20080059797A1 (en) Data Communication System, Agent System Server, Computer Program, and Data Communication Method
US20060167810A1 (en) Multi-merchant purchasing environment for downloadable products
US20030084294A1 (en) System and method for authentication
US20030061120A1 (en) Order processing system and method
US20020131601A1 (en) Cryptographic key management method
US20060089906A1 (en) Method for securing a payment transaction over a public network
US20090157527A1 (en) Communication mechanisms for multi-merchant purchasing environment for downloadable products
US7058619B2 (en) Method, system and computer program product for facilitating digital certificate state change notification
CA2279941C (en) Recording medium with a signed hypertext recorded thereon, signed hypertext generating method and apparatus, and signed hypertext verifying method and apparatus
JP2003526858A (ja) 電子商取引での取引の容易化
US7340773B2 (en) Multi-stage authorisation system
US8402520B1 (en) Authentication protocol for network security services
US7483863B2 (en) Electronic commerce information processing system and method
US20030163374A1 (en) Point service providing system with mechanism for preventing illegal use of point data
JP2001216360A (ja) 予約証明証発行装置および方法

Legal Events

Date Code Title Description
AS Assignment

Owner name: HITACHI, LTD., JAPAN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KAWAMURA, SHUNJI;TOMITA, TAMINORI;REEL/FRAME:012563/0497;SIGNING DATES FROM 20011218 TO 20011220

FEPP Fee payment procedure

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FEPP Fee payment procedure

Free format text: PAYER NUMBER DE-ASSIGNED (ORIGINAL EVENT CODE: RMPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FEPP Fee payment procedure

Free format text: PAYER NUMBER DE-ASSIGNED (ORIGINAL EVENT CODE: RMPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FPAY Fee payment

Year of fee payment: 4

FPAY Fee payment

Year of fee payment: 8

FEPP Fee payment procedure

Free format text: MAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.)

LAPS Lapse for failure to pay maintenance fees

Free format text: PATENT EXPIRED FOR FAILURE TO PAY MAINTENANCE FEES (ORIGINAL EVENT CODE: EXP.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

STCH Information on status: patent discontinuation

Free format text: PATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362

FP Lapsed due to failure to pay maintenance fee

Effective date: 20181017